PT-2024-36026 · Parasolid · Parasolid

Published 2024-12-10 · Updated 2024-12-12 · CVE-2024-54091

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Parasolid versions prior to V36.1.225 Parasolid versions prior to V37.0.173 Parasolid versions prior to V37.1.1

Description: A vulnerability has been identified in the affected application, which contains an out of bounds write past the end of an allocated buffer while parsing X T data or a specially crafted file in X T format. This could allow an attacker to execute code in the context of the current process.

Recommendations: For Parasolid versions prior to V36.1.225, update to version V36.1.225 or later. For Parasolid versions prior to V37.0.173, update to version V37.0.173 or later. For Parasolid versions prior to V37.1.1, update to version V37.1.1 or later. As a temporary workaround, consider restricting the parsing of X T data or specially crafted files in X T format until a patch is available.

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2024-54091

Affected Products

Parasolid

References · 7

• https://osv.dev/vulnerability/CVE-2024-54091 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-54091 · Security Note
• https://cert-portal.siemens.com/productcert/html/ssa-979056.html · Vendor Advisory
• https://cert-portal.siemens.com/productcert/html/ssa-672923.html · Vendor Advisory
• https://twitter.com/CVEnew/status/1866486770050724058 · Twitter Post
• https://t.me/cvedetector/12498 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1866504920045601061 · Twitter Post